Unit 4: TCP, UDP and ports · Lesson 1 of 6 · 15 min
TCP and UDP
Compare the two transport protocols and see which one carries which traffic.
mission
- You are
- The analyst writing firewall rules for the DNS team.
- Situation
- The DNS team asked for port 53 to be opened, but did not say whether they need TCP, UDP or both.
- Goal
- Show which transport the office's lookups use and why both exist.
- Hand in
- The protocol and port carrying the queries in dns.pcap.
TCP and UDP side by side
| Command | What it does |
|---|---|
TCP | Connection first, ordered, retransmits. Web, mail, SSH |
UDP | No connection, no ordering, no retries. DNS, time sync, video calls, QUIC |
ip.proto 6 | The IP header's way of saying TCP follows |
ip.proto 17 | The IP header's way of saying UDP follows |
A DNS question, wrapped
Each step wraps the data in one more header, the way a sender builds a packet.
Check the protocol number
The IP header names the transport inside it. 6 is TCP, 17 is UDP.
tshark -r layers.pcap -c 1 -T fields -e ip.proto -e tcp.dstport 6 80 tshark -r dns.pcap -c 2 -T fields -e frame.protocols eth:ethertype:ip:udp:dns eth:ethertype:ip:udp:dns
you should see The web request rides on TCP, the DNS lookups on UDP.
Look up well-known ports
/etc/services maps port numbers to service names. It is a convention, not a rule.
grep -E '^(domain|http|https|ssh)\s' /etc/services
ssh 22/tcp # SSH Remote Login Protocol
domain 53/tcp # Domain Name Server
domain 53/udp
http 80/tcp www # WorldWideWeb HTTP
https 443/tcp # http protocol over TLS/SSL
https 443/udp # HTTP/3
you should see DNS is listed for both TCP and UDP, and HTTPS now uses UDP too, for HTTP/3.
defender tip Answer the DNS team with both: UDP 53 for normal lookups, TCP 53 for large answers and zone transfers, and only to the DNS servers.
Count TCP and UDP in a real capture
Protocol 6 is TCP and 17 is UDP.
tshark -r incident.pcap -T fields -e ip.proto | sort | uniq -c
32 17
818 6
you should see 818 TCP packets and 32 UDP packets, almost all of them DNS.
See which UDP service was used
UDP traffic on an office network is mostly DNS. Anything else deserves a name.
tshark -r incident.pcap -Y 'udp && !(udp.port==53)' | wc -l
0
you should see Zero UDP packets that are not DNS.
What a defender takes away
- 1TCP for conversations that must arrive whole, UDP for quick questions and live media.
- 2A port number is a convention. Check what actually answers.
- 3HTTP/3 runs over UDP 443, so blocking only TCP 443 no longer blocks the web.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.